cache session token if given by user and is valid?